Home page logo

fulldisclosure logo Full Disclosure mailing list archives

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability
From: "ddivulnalert () ddifrontline com" <ddivulnalert () ddifrontline com>
Date: Mon, 25 Jan 2010 12:58:09 -0600

DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability


Date Discovered
November 19, 2009

Discovered By
Digital Defense, Inc. Vulnerability Research Team
Credit: Rob Kraus, Chris Graham and r () b13$

Vulnerability Description
The login page of the F2L-3000 version 4.0.0 is vulnerable to SQL
Injection. Exploitation of the vulnerability may allow attackers to
bypass authentication and access sensitive information stored on the

Solution Description
A patch is not available at this time. Possible workarounds include
disabling the vulnerable service, or limiting access to a set of trusted
IP addresses.

Tested Systems / Software 
F2L-3000 version 4.0.0 is the only platform that has been manually
tested. Earlier versions and other, similar models may also be
vulnerable as the platform is sold in various configurations.

Vendor Contact
Vendor Website: http://www.files2links.com/

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
  • DDIVRT-2009-27 F2L-3000 files2links SQL Injection Vulnerability ddivulnalert () ddifrontline com (Jan 25)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]